No Encryptors, No Problem: The Coinbase Cartel Ransomware Group

The ransomware threat actor Coinbase Cartel first emerged in September 2025 and claimed 14 victims that month. The group focuses on data exfiltration, which aligns with a trend Bitdefender is tracking in the ongoing evolution of ransomware.

Currently, the most prolific double-extortion groups, and even emerging single-extortion groups, are increasingly executing data exfiltration-focused ransomware campaigns without encrypting data during attacks.

This approach makes the attacks both quieter and faster to execute while maintaining leverage for a ransom payment: pay to get your stolen data back, or we’ll publish it for the world to see.

Coinbase…